Conditional policies per signer

Some applications need different transaction policies depending on which party authorizes a transaction. For example, a restricted signer should only be allowed to send small transfers, while a full-access signer can send transactions of any size. Privy supports this through additional signers with override policies. Each signer added to a wallet can have its own policy, so the constraints applied to a transaction depend on which signer authorizes it.

How it works

Each wallet can have multiple additional signers (authorization keys or key quorums)
Each signer can have an override policy that defines what policies that signer is subject to
When a signer submits a transaction, Privy evaluates only that signer’s override policy — not the policies of other signers
If the transaction satisfies the signer’s policy, Privy signs it. Otherwise, Privy denies the request

This gives the same wallet different levels of access depending on which signer acts, without needing separate wallets.

Setup

At a high level:

Create policies

Define a policy for each access level (e.g., a restrictive policy and a permissive policy).

Create authorization keys

Create an authorization key (or key quorum) for each signer that needs access to the wallet.

Add signers with override policies

Add each signer to the wallet with its corresponding policy.

Route transactions through the appropriate signer

Your server selects which authorization key to sign with based on the context of the request.

1. Create policies

Define a policy for each signer. In this example, the restricted signer can only send small USDC transfers, while the full-access signer can send transactions to any address.

import {PrivyClient} from '@privy-io/node';
import {erc20Abi, parseUnits} from 'viem';

const privy = new PrivyClient({
  appId: 'insert-your-app-id',
  appSecret: 'insert-your-app-secret'
});

const USDC_ADDRESS = '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48';

// Restrictive policy: only USDC transfers under 1,000
const restrictivePolicy = await privy.policies().create({
  name: 'Small USDC transfers only',
  version: '1.0',
  chain_type: 'ethereum',
  rules: [
    {
      name: 'Allow small USDC transfers',
      method: 'eth_sendTransaction',
      action: 'ALLOW',
      conditions: [
        {
          field_source: 'ethereum_transaction',
          field: 'to',
          operator: 'eq',
          value: USDC_ADDRESS
        },
        {
          field_source: 'ethereum_calldata',
          field: 'transfer.amount',
          abi: erc20Abi,
          operator: 'lte',
          value: parseUnits('1000', 6).toString()
        }
      ]
    }
  ]
});

// Permissive policy: allow any eth_sendTransaction
const permissivePolicy = await privy.policies().create({
  name: 'Allow all transactions',
  version: '1.0',
  chain_type: 'ethereum',
  rules: [
    {
      name: 'Allow all sends',
      method: 'eth_sendTransaction',
      action: 'ALLOW',
      conditions: []
    }
  ]
});

Save the id from each policy response. These are needed when adding signers to the wallet.

Create a policy

Learn more about defining policies with rules and conditions.

2. Create authorization keys

Create a separate authorization key for each signer. Each key corresponds to a different party or service that needs wallet access.

Create authorization keys

Generate keypairs and register them in the Privy Dashboard or via the SDK.

Store each private key securely (e.g., in a secrets manager). In the examples below, these are referenced as restrictedSignerPrivateKey and fullAccessSignerPrivateKey.

3. Add signers with override policies

Add each authorization key as a signer on the wallet, attaching the appropriate override policy. The override policy scopes what that specific signer can authorize.

Update the wallet with the desired additional_signers. The wallet owner must sign the request.

export {};
declare const privy: any;
const walletId = 'insert-wallet-id';

const wallet = await privy.wallets().update(walletId, {
  additional_signers: [
    {
      signer_id: '<restricted-signer-authorization-key-id>',
      override_policy_ids: ['<restrictive-policy-id>']
    },
    {
      signer_id: '<full-access-signer-authorization-key-id>',
      override_policy_ids: ['<permissive-policy-id>']
    }
  ]
});

4. Route transactions through the appropriate signer

Your server selects which authorization key to use based on the request context. For example, an automated service signs with the restricted signer, while an admin endpoint signs with the full-access signer.

export {};
declare const privy: any;
const walletId = 'insert-wallet-id';
const botTransaction = {};
const adminTransaction = {};
const restrictedSignerPrivateKey = 'insert-restricted-signer-private-key';
const fullAccessSignerPrivateKey = 'insert-full-access-signer-private-key';

async function sendTransaction(walletId: string, transaction: object, signerPrivateKey: string) {
  const result = await privy
    .wallets()
    .ethereum()
    .sendTransaction(walletId, {
      caip2: 'eip155:1',
      params: {transaction},
      authorization_context: {
        authorization_private_keys: [signerPrivateKey]
      }
    });

  return result;
}

// Automated bot uses the restricted signer
await sendTransaction(walletId, botTransaction, restrictedSignerPrivateKey);

// Admin uses the full-access signer
await sendTransaction(walletId, adminTransaction, fullAccessSignerPrivateKey);

If the transaction violates the signer’s override policy, Privy denies the request. Transactions do not fall back to another signer’s policy — Privy evaluates each signer independently.

Learn more

Additional signers

Add signers to wallets and manage their permissions.

Policies

Define rules that constrain which transactions are allowed.

Authorization keys

Create and manage server-controlled authorization keys.

​How it works

​Setup

​1. Create policies

Create a policy

​2. Create authorization keys

Create authorization keys

​3. Add signers with override policies

​4. Route transactions through the appropriate signer

​Learn more

Additional signers

Policies

Authorization keys

How it works

Setup

1. Create policies

2. Create authorization keys

3. Add signers with override policies

4. Route transactions through the appropriate signer

Learn more